Privacy policy

Last updated 26 October 2026

This policy explains what personal data Hair Xpress collects, why, who we share it with, and your rights. Combrook Limited is the data controller.

1. What we collect

Account details: your name, email address, username, password (stored securely, never readable), mobile number if you give it, and your roles.
Bookings: services, dates, times, prices, places, notes, payment status, and attendance (attended, cancelled, no-show).
Hair Passport: your QR code, and treatment and colour records (such as formulas and processing times) added by professionals.
Location: postcodes and addresses you give us for appointments and work locations, and their map position. If you tap "Use my current location", your phone's position is used once to find the nearest postcode (through postcodes.io) and is not stored.
Messages you send through Hair Xpress.
Professionals and salons: business details, working hours, services and prices, insurance and qualification documents, public page text and photos, verification status, and commission and earnings records.
Payments: handled by Stripe. We receive payment status and limited details (such as the last four card digits), not your full card number. For payouts, Stripe collects identity and bank details from professionals and salons.
Technical data: sign-in sessions, IP address and browser type for security, and counts of views and clicks on sponsored content (without third-party tracking).
Problem reports you send us while testing or using Hair Xpress.

2. Why we use it, and our legal basis

To provide Hair Xpress (accounts, matching, bookings, payments, messages, reminders): performance of our contract with you.
To keep Hair Xpress safe (verification, insurance checks, fraud prevention, hiding contact details in messages, audit records): our legitimate interests and legal obligations.
Attendance counts shown to professionals and salons you book: our legitimate interest in reducing no-shows. Only counts are shown, not which salon or professional.
Hair Passport records from other salons: shared only with your consent, given when you approve access.
Records and accounts: to meet tax, accounting and legal obligations.
Marketing: only if you opt in, and you can opt out at any time.

3. Who sees your data

Professionals and salons see what they need for your booking, and only while you have an active booking with them. They do not see your email or phone number; contact happens through Hair Xpress messages.
Clients see a professional's or salon's public page. Professionals' home addresses are never shown.
Service providers who work for us: Stripe (payments), our web hosting and email provider (Fasthosts, UK), postcodes.io (looking up postcodes, and the nearest postcode to where you are when you ask), and Anthropic (an automatic check that pictures salons and professionals publish don't show contact details). They may only use your data to provide their service to us.
Authorities where the law requires it.

We do not sell your personal data.

4. International transfers

Your data is stored in the UK. Some providers (such as Stripe) may process data outside the UK; where they do, appropriate safeguards are in place. As Hair Xpress launches in other countries, data needed for bookings in those countries may be processed there, with the same protections.

5. How long we keep it

We keep your account data while your account is open. Booking, payment and audit records are kept for up to 7 years for tax, accounting and dispute purposes. Messages are kept while either party's account is open, unless needed for a dispute. Verification documents are kept while a professional or salon is active and for up to 2 years after. When data is no longer needed, we delete or anonymise it.

6. Cookies

We use only cookies needed to run Hair Xpress, such as keeping you signed in and protecting forms. We do not use advertising or third-party tracking cookies.

7. Your rights

You can ask to access, correct or delete your data, to restrict or object to how we use it, and to receive a copy of it. You can withdraw consent at any time where we rely on consent. Contact us at the address below. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk), though we would like the chance to help first.

8. Children

Hair Xpress accounts are for people aged 18 and over. Parents or guardians may book services for their children using their own account.

9. Security

We protect your data with encryption in transit, secure password storage, access controls, private storage for documents (shared only through short-lived links), and audit records of sensitive changes.

10. Changes to this policy

We may update this policy from time to time, for example when we add features, launch in new countries or when the law changes. The date at the top shows the latest version. For significant changes we will tell you by email or in the app.

Who we are

Hair Xpress is operated by Combrook Limited, a company registered in England and Wales (company number 12789408), registered office Park Lane, Poynton, Cheshire SK12 1RQ. We are registered with the Information Commissioner's Office (ICO), registration number ZC262227.